@mettlecast/domain-runtime 0.2.72 → 0.2.73

package/dist/ctx/cognito.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Cognito control-plane context. Automatically scoped to the configured
+ * user pool — domain code never passes `UserPoolId`.
+ *
+ * The runtime creates this when `COGNITO_USER_POOL_ID` is set in the
+ * Lambda environment. Domain code accesses it via `ctx.cognito`.
+ */
+export interface CognitoContext {
+    /**
+     * Create a user in the configured user pool. Tolerates
+     * `UsernameExistsException` — returns normally if the user already exists.
+     *
+     * @param params.username - Email or username.
+     * @param params.userAttributes - Optional attributes (defaults to email + email_verified=true).
+     * @param params.suppressMessage - If true (default), suppresses the welcome email.
+     */
+    adminCreateUser(params: {
+        username: string;
+        userAttributes?: Record<string, string>;
+        suppressMessage?: boolean;
+    }): Promise<void>;
+    /**
+     * Set a user's password, optionally permanent.
+     *
+     * @param params.username - Email or username.
+     * @param params.password - The password to set.
+     * @param params.permanent - If true (default), the user does not need to change it on first login.
+     */
+    adminSetUserPassword(params: {
+        username: string;
+        password: string;
+        permanent?: boolean;
+    }): Promise<void>;
+    /**
+     * Fetch a user's attributes and status.
+     *
+     * @param params.username - Email or username.
+     * @returns User attributes as a flat record, plus enabled/status flags.
+     */
+    adminGetUser(params: {
+        username: string;
+    }): Promise<{
+        userAttributes: Record<string, string>;
+        enabled: boolean;
+        userStatus: string;
+    }>;
+    /**
+     * Delete a user from the configured user pool.
+     *
+     * @param params.username - Email or username.
+     */
+    adminDeleteUser(params: {
+        username: string;
+    }): Promise<void>;
+    /**
+     * Update a user's attributes.
+     *
+     * @param params.username - Email or username.
+     * @param params.attributes - Attributes to set.
+     */
+    adminUpdateUserAttributes(params: {
+        username: string;
+        attributes: Record<string, string>;
+    }): Promise<void>;
+}

package/dist/ctx/cognito.js

@@ -0,0 +1 @@
+export {};

package/dist/ctx/context.d.ts

@@ -6,6 +6,7 @@ import type { FeatureFlags } from '../runtime/feature-flags.js';
 import type { AuditContext } from '../runtime/audit.js';
 import type { DomainStoreContext } from './store.js';
 import type { DomainFilesContext } from './files.js';
+import type { CognitoContext } from './cognito.js';
 /**
  * The unified domain context injected into every handler.
  * All fields are always populated by the runtime; no field is ever null.
@@ -47,6 +48,8 @@ export interface DomainContext {
     store: DomainStoreContext;
     /** Per-domain S3 file store, automatically scoped to the current tenant. */
     files: DomainFilesContext;
+    /** Cognito control-plane client (Admin* operations). Noop when no user pool is configured. */
+    cognito: CognitoContext;
     /** URL path parameters from the incoming request, excluding tenantId (e.g. { tableName: 'users' }). */
     pathParams: Record<string, string>;
 }

package/dist/ctx/index.d.ts

@@ -4,3 +4,4 @@ export type { PublishFn, IdempotencyContext, CacheContext, TibFetch, Logger, Tra
 export type { DomainContext } from './context.js';
 export type { DomainStoreContext, StoreQueryOptions, StoreQueryResult } from './store.js';
 export type { DomainFilesContext, FilesPutOptions, FilesListResult } from './files.js';
+export type { CognitoContext } from './cognito.js';

package/dist/runtime/cognito.d.ts

@@ -0,0 +1,32 @@
+import type { CognitoContext } from '../ctx/cognito.js';
+/** Options for the Cognito context factory. */
+export interface CognitoOptions {
+    /**
+     * Cognito User Pool ID. Defaults to process.env.COGNITO_USER_POOL_ID.
+     * If not set, the factory returns a noop context that throws on any call.
+     */
+    userPoolId?: string;
+    /**
+     * AWS region. Defaults to process.env.COGNITO_AWS_REGION or process.env.AWS_REGION.
+     */
+    region?: string;
+}
+/**
+ * Create a CognitoIdentityProvider-backed CognitoContext.
+ *
+ * The SDK client is created lazily on first use. The `UserPoolId` is
+ * captured at construction time from `COGNITO_USER_POOL_ID` — domain
+ * code never needs to pass it.
+ *
+ * `adminCreateUser` tolerates `UsernameExistsException` so that
+ * idempotent retries (e.g. bootstrap re-runs) don't fail.
+ *
+ * @param options - CognitoOptions. If userPoolId is not resolved, returns a noop.
+ * @returns A CognitoContext backed by the AWS SDK, or a noop that throws.
+ */
+export declare function createCognito(options?: CognitoOptions): CognitoContext;
+/**
+ * Create a noop CognitoContext for tests or environments without Cognito.
+ * Every method throws with a clear message.
+ */
+export declare function createNoopCognito(): CognitoContext;

package/dist/runtime/cognito.js

@@ -0,0 +1,108 @@
+/**
+ * Create a CognitoIdentityProvider-backed CognitoContext.
+ *
+ * The SDK client is created lazily on first use. The `UserPoolId` is
+ * captured at construction time from `COGNITO_USER_POOL_ID` — domain
+ * code never needs to pass it.
+ *
+ * `adminCreateUser` tolerates `UsernameExistsException` so that
+ * idempotent retries (e.g. bootstrap re-runs) don't fail.
+ *
+ * @param options - CognitoOptions. If userPoolId is not resolved, returns a noop.
+ * @returns A CognitoContext backed by the AWS SDK, or a noop that throws.
+ */
+export function createCognito(options = {}) {
+    const userPoolId = options.userPoolId ?? process.env['COGNITO_USER_POOL_ID'];
+    if (!userPoolId) {
+        return createNoopCognito();
+    }
+    const region = options.region ?? process.env['COGNITO_AWS_REGION'] ?? process.env['AWS_REGION'] ?? 'eu-north-1';
+    let client;
+    async function getClient() {
+        if (!client) {
+            const sdk = await import('@aws-sdk/client-cognito-identity-provider');
+            client = new sdk.CognitoIdentityProviderClient({ region });
+        }
+        return client;
+    }
+    return {
+        async adminCreateUser(params) {
+            const sdk = await import('@aws-sdk/client-cognito-identity-provider');
+            const c = await getClient();
+            try {
+                await c.send(new sdk.AdminCreateUserCommand({
+                    UserPoolId: userPoolId,
+                    Username: params.username,
+                    MessageAction: params.suppressMessage === false ? undefined : 'SUPPRESS',
+                    UserAttributes: Object.entries(params.userAttributes ?? { email: params.username, email_verified: 'true' }).map(([Name, Value]) => ({ Name, Value })),
+                }));
+            }
+            catch (err) {
+                if (err instanceof Error && err.name === 'UsernameExistsException') {
+                    return;
+                }
+                throw err;
+            }
+        },
+        async adminSetUserPassword(params) {
+            const sdk = await import('@aws-sdk/client-cognito-identity-provider');
+            const c = await getClient();
+            await c.send(new sdk.AdminSetUserPasswordCommand({
+                UserPoolId: userPoolId,
+                Username: params.username,
+                Password: params.password,
+                Permanent: params.permanent ?? true,
+            }));
+        },
+        async adminGetUser(params) {
+            const sdk = await import('@aws-sdk/client-cognito-identity-provider');
+            const c = await getClient();
+            const result = await c.send(new sdk.AdminGetUserCommand({
+                UserPoolId: userPoolId,
+                Username: params.username,
+            }));
+            const userAttributes = {};
+            for (const attr of result.UserAttributes ?? []) {
+                if (attr.Name && attr.Value) {
+                    userAttributes[attr.Name] = attr.Value;
+                }
+            }
+            return {
+                userAttributes,
+                enabled: result.Enabled ?? true,
+                userStatus: result.UserStatus ?? 'UNKNOWN',
+            };
+        },
+        async adminDeleteUser(params) {
+            const sdk = await import('@aws-sdk/client-cognito-identity-provider');
+            const c = await getClient();
+            await c.send(new sdk.AdminDeleteUserCommand({
+                UserPoolId: userPoolId,
+                Username: params.username,
+            }));
+        },
+        async adminUpdateUserAttributes(params) {
+            const sdk = await import('@aws-sdk/client-cognito-identity-provider');
+            const c = await getClient();
+            await c.send(new sdk.AdminUpdateUserAttributesCommand({
+                UserPoolId: userPoolId,
+                Username: params.username,
+                UserAttributes: Object.entries(params.attributes).map(([Name, Value]) => ({ Name, Value })),
+            }));
+        },
+    };
+}
+/**
+ * Create a noop CognitoContext for tests or environments without Cognito.
+ * Every method throws with a clear message.
+ */
+export function createNoopCognito() {
+    const msg = 'ctx.cognito: COGNITO_USER_POOL_ID is not set. Configure the auth stack to enable Cognito operations.';
+    return {
+        async adminCreateUser() { throw new Error(msg); },
+        async adminSetUserPassword() { throw new Error(msg); },
+        async adminGetUser() { throw new Error(msg); },
+        async adminDeleteUser() { throw new Error(msg); },
+        async adminUpdateUserAttributes() { throw new Error(msg); },
+    };
+}

package/dist/runtime/hydrate.d.ts

@@ -6,6 +6,7 @@ import type { DbContext } from '../ctx/db.js';
 import type { IntegrationDefinition } from '../primitives/integration.js';
 import type { DomainStoreContext } from '../ctx/store.js';
 import type { DomainFilesContext } from '../ctx/files.js';
+import type { CognitoContext } from '../ctx/cognito.js';
 import type { ActionRegistry } from './actions.js';
 /**
  * Full options for hydrateCtx. All fields are optional — defaults are used for
@@ -110,6 +111,8 @@ export interface HydrateOptions {
     domainBucketName?: string;
     /** URL path parameters to expose via ctx.pathParams (tenantId already excluded by caller). */
     pathParams?: Record<string, string>;
+    /** Override the Cognito context. If omitted, createCognito() is used (reads COGNITO_USER_POOL_ID from env). */
+    cognito?: CognitoContext;
 }
 /**
  * Hydrates a fully populated DomainContext from a Lambda invocation event and options bag.

package/dist/runtime/hydrate.js

@@ -2,7 +2,7 @@ import { createLogger } from './logger.js';
 import { createTracer } from './tracer.js';
 import { createCache } from './cache.js';
 import { createFetch } from './fetch.js';
-import { createSecrets, createEmptySecrets } from './secrets.js';
+import { createSecrets, createEmptySecrets, createSecretsFromAppSecret } from './secrets.js';
 import { createIdempotency, createNoopIdempotency } from './idempotency.js';
 import { createPublisher } from './publisher.js';
 import { createDb, createMockDb } from './db.js';
@@ -15,6 +15,7 @@ import { createAudit } from './audit.js';
 import { extractObservabilityBindings } from './observability-bindings.js';
 import { createStore, createNoopStore } from './store.js';
 import { createFiles, createNoopFiles } from './files.js';
+import { createCognito } from './cognito.js';
 /**
  * Hydrates a fully populated DomainContext from a Lambda invocation event and options bag.
  * All 14 DomainContext fields are populated. Fields with AWS dependencies fall back to
@@ -75,6 +76,9 @@ export async function hydrateCtx(_event, options = {}) {
     else if (options.secretNames && options.secretNames.length > 0) {
         secrets = await createSecrets({ secretNames: options.secretNames });
     }
+    else if (process.env['APP_SECRET_ARN']) {
+        secrets = await createSecretsFromAppSecret(process.env['APP_SECRET_ARN']);
+    }
     else {
         secrets = createEmptySecrets();
     }
@@ -167,6 +171,7 @@ export async function hydrateCtx(_event, options = {}) {
     const files = options.files ?? ((options.domainBucketName ?? process.env['DOMAIN_BUCKET_NAME'])
         ? createFiles({ bucketName: options.domainBucketName ?? process.env['DOMAIN_BUCKET_NAME'], tenantId: tenant.id, tenantRoleArn: process.env['DOMAIN_TENANT_ROLE_ARN'] })
         : createNoopFiles());
+    const cognito = options.cognito ?? createCognito();
     ctx = {
         db,
         publish,
@@ -186,6 +191,7 @@ export async function hydrateCtx(_event, options = {}) {
         audit,
         store,
         files,
+        cognito,
         pathParams: options.pathParams ?? {},
     };
     return ctx;

package/dist/runtime/index.d.ts

@@ -60,3 +60,5 @@ export type { CreateWebhookHandlerOptions } from './webhook-handler.js';
 export { healthHandler, readinessHandler } from './health-handler.js';
 export { createStore, createNoopStore } from './store.js';
 export { createFiles, createNoopFiles } from './files.js';
+export { createCognito, createNoopCognito } from './cognito.js';
+export type { CognitoOptions } from './cognito.js';

package/dist/runtime/index.js

@@ -63,3 +63,4 @@ export { healthHandler, readinessHandler } from './health-handler.js';
 // Storage runtime
 export { createStore, createNoopStore } from './store.js';
 export { createFiles, createNoopFiles } from './files.js';
+export { createCognito, createNoopCognito } from './cognito.js';

package/dist/runtime/secrets.d.ts

@@ -27,3 +27,9 @@ export declare function createSecrets(options: SecretsOptions): Promise<SecretsP
  * @returns An empty frozen SecretsProxy.
  */
 export declare function createEmptySecrets(): SecretsProxy;
+/**
+ * Fetches a single Secrets Manager secret by ARN, parses it as JSON
+ * key-value pairs, and returns a SecretsProxy. Used when APP_SECRET_ARN
+ * is set — the AppSecret stores all domain secrets as a JSON object.
+ */
+export declare function createSecretsFromAppSecret(secretArn: string): Promise<SecretsProxy>;

package/dist/runtime/secrets.js

@@ -27,3 +27,22 @@ export async function createSecrets(options) {
 export function createEmptySecrets() {
     return Object.freeze({});
 }
+/**
+ * Fetches a single Secrets Manager secret by ARN, parses it as JSON
+ * key-value pairs, and returns a SecretsProxy. Used when APP_SECRET_ARN
+ * is set — the AppSecret stores all domain secrets as a JSON object.
+ */
+export async function createSecretsFromAppSecret(secretArn) {
+    const region = process.env['AWS_REGION'] ?? 'eu-north-1';
+    const client = new SecretsManagerClient({ region });
+    const cmd = new GetSecretValueCommand({ SecretId: secretArn });
+    const res = await client.send(cmd);
+    const raw = res.SecretString ?? '{}';
+    try {
+        const parsed = JSON.parse(raw);
+        return Object.freeze({ ...parsed });
+    }
+    catch {
+        return Object.freeze({});
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mettlecast/domain-runtime",
-  "version": "0.2.72",
+  "version": "0.2.73",
   "type": "module",
   "publishConfig": {
     "registry": "https://registry.npmjs.org",